Changes

==MAIL SERVER RESOURCESOVERVIEW & PREPARATION==

* [https://preziWe are going to spread the remaining email labs over a few weeks, so that by the end of this topic, you will have a sufficient understanding of what services are involved in sending, filtering, and reading email.com/iuk-advzak_o/mail-servers-postfix/ OPS335 Mail Server Notes ] Course Note providing Concepts and Overview of You will also have the skills to configure a basic mail server setup* [http://www.fredshackusing the default services provided for your Centos7 Linux distribution.com/docs/postfix.html Postfix for Dummies] Good Basic Guide to setup Postfix MTA

==OVERVIEW & PREPARATION==This lab will show you how to set up a '''Postfix''' email server ('''MTA''') on your '''VM2''' and '''VM3''' machines. You will also be setting up on your '''VM2''' and '''VM3''' machines the '''mailx''' package ('''MUA''') to allow users to send and receive text[[Image:Email-based mail messages. You should also be able to send email messages to your Seneca College email accountservers.png]]

The diagram below shows This lab will show you how to set up a Mail User Agent ('''MUA'''), using the layout of '''mailx''' package on your '''vm2''' machine to send and receive e-mails on your local VM. In this case, the what this lab should '''Postfix''' package which represents your '''MTA''' is most likely already installed and running on your local VM. In addition to sending and receiving emails on your Local VM, you will also be able to accomplish:send a text-based e-mail from your '''vm2 machine''' to your '''Seneca mail account'''. You will also learn how to make multiple MTAs in the same network collaborate in sending emails. In addition, you will learn where the message store (MS) is located that stores mail messages until they are viewed and either deleted or transferred to other folders.

[[Image===Online References:email-setup.png]]===

==INVESTIGATION 1: INSTALL & SETUP , SET-UP, AND USE THE MAIL TRANSFER USER AGENT (MTA'''MUA''')==

{{Admon/important|Prerequistites|<ol><li>Ensure <u>all</u> machines have been updated and that the We will be using a simple text-based '''Mail User Agent (MUA)''' called '''mailx'''clocks are set in this lab to the correct date '''both send and timereceive''' mail messages within your '''vm2'''.<br></li><li>Due machine and to the changes made in this lab3, '''you will now need only send''' mail messages from your vm1 running (as the DNS server)''' in order for any of vm2''' machine to your virtual machines to be able to use the internetSeneca e-mail account.</li></ol>}}

Before proceeding with this lab, we need to confirm our machines have connectivity to === Installing the Internet before we can install and start sending e-mail messages.Mail User Agent (MUA)===

'''Perform the following stepsSteps:''' #Make certain you are in your '''vm2''' machine.#Install the '''mailx''' application (MUA) using yum:'''NOTE:''' You can refer to the link below to acquaint yourself on how to send e-mail messages using '''mailx''' application:<br> [http://www.simplehelp.net/2008/12/01/how-to-send-email-from-the-linux-command-line/ Mail Send Command Examples]

#Make certain that you can connect to the Internet on ===Sending a Mail Message from your Host vm2 Machine via web-browser. Since your host should be using '''VM1''' as its '''DNS server''', you will need to make certain that the '''VM1''' machine is running as well.#Start a web-browser on your '''Host Machine''', and access your Seneca e-mail account (https://myseneca.ca).#Confirm that you can access the web from your '''VM2''' machine. You can install the '''wget''' or ly'''n'''x applications in order to test this for your text-based server.<br>'''NOTE:''' you should not have to authenticate yourself on the guest machine.Email Account===

===Install {{Admon/important|Note|These instructions no longer work reliably. You can still send email to your own email server, and Configure Postfix Package (MTA) on look at the server logs to see that it did really get sent. But it probably won't be accepted for one of a VM===multitude of good reasons. If it doesn't work for you: don't worry about it for lab submission purposes.}}

We will now be installing the postfix application which will act as the Mail Transfer Agent ('''test to see if your MTA''') that will send and receive for your vm2 machine is correctly running by sending email messages from your vm2 machine to your Seneca e-mail messages between various server.<br>In our case, between our servers '''vm2''' and '''vm3''', as well as between our '''vm2''' server and an outside server: '''Seneca College''' (https://myseneca.ca)account.

#Switch to Make certain you are still in your '''VM2vm2''' machine.#Check the status of the Test email from your machine by sending an email to your '''sendmailSeneca email account''' service by using the '''systemctl''' command. If the sendmail service is running, use the ''systemctl'' command to stop and disable that service. #Issue the following command to install the :<br>'''Postfixmail -s "Lab4a - test1" <Your Seneca email address>''' application (MTA):<br><br>'''yum install postfixNOTE:'''<br><br>#What is after you type in the purpose body of installing the postfix application in terms of using e-mail? Record your answer in your lab logbook.#We need message, move to <u>configure</u> an empty line, and then press the postfix application (i.e. our MTA) to recognize our recently-created domain name that we setup in lab3.<br>Edit the Postfix configuration file: key combination '''/etc/postfix/main.cf&lt;ctrl&gt;&lt;d&gt;''' and edit this file to contain only send the contents displayed below:<br><br>'''mydomain = senecaIDmessage.org'''<br>'''myorigin = $mydomain'''<br>'''mynetworks = 127.0.0.0#Check your Seneca email account (Inbox /8, 192.168.X.0/24'''Junk Email Folder) to see if you got the email (note that it may take a <bru>'''relay_domains ='''few minutes to arrive<br/u>'''inet_interfaces=all'''<br><br>Your MTA has the ability to resolve "fake" public address , so you may also wish to try an actual user alternate email account name. For example, if you have a user account called "msaul"one like gmail, etc). When you can have the MTA resolve the fake name "murray.saul" to the account name "msaul". In order to do this you need to create an alias which is contained in receive that email, make a note of the MTA's alias filereturn address.<br><br>#Edit If you did not receive the '''/etc/postfix/aliases''' file and add mail, check the mail logs on your first name as an alias vm2 machine to be resolved to your VM2's account name:<br><br>'''your-first-name''' &nbsp; &nbsp; &nbsp; '''your-vm2-regular-username'''<br><br>determine any errors messages that would indicate a mail server setup problem.#In order Once you have succeeded in sending the first email, send a second email to update the MTA's database for the newly-create alias, issue same destination using the following command:<br>'''postalias hash:/etc/aliases'''mail -r "someone@hacker.com (Canadian Revenue Agency)" -s "Lab4a - test2" <br><brYour Seneca email address>#Finally, Check your email to start and enable your MTAsee if you got the email. If you did, issue make a note of the following commands:<br><br>'''systemctl start postfixreturn address.service'''<br>'''systemctl enable postfix.service'''<br><br>#Check How would you think that including the '''/var/log/messages-r''' file option could be used by penetration hackers to gain access to a computer system? What sort of steps do you think should be taken to see that your MTA server started without error If there are any errors, correct them before continuing.help prevent this type of attack from happening?

We will now test both your MUA (mailx) and MTA (postfix) by sending and receiving e-mail messages on the local vm2 machine only. '''Record steps, commands, and your observations in INVESTIGATION 1 in your OPS335 lab log-bookPerform the following Steps:'''

=='''Record steps, commands, and your observations in INVESTIGATION 2: INSTALL &amp; SETUP THE MAIL USER AGENT (MUA)==1 in your OPS335 lab log-book'''

We will be using a simple text-based Mail User Agent ==INVESTIGATION 2: SETUP MTA TO SEND MAIL MESSAGES ('''MUA'''NO ENCRYPTION) called '''mailx''' in this lab to send and '''receive''' messages between your running mail servers.==

=== Installing We will be using the Mail User Agent '''Postfix''' application as the '''MTA''', and we will be setting it up on your '''vm2''' and '''vm3''' machines. They will act as the "sending" email servers for your internal network. You will be able to send email out of your network, and receive email from within your network, but you will '''<u>not</u>''' receive email from outside of your network due to the following reasons:* Individuals outside of your domain will never find the MX records because there are no other DNS servers pointing to your DNS server (MUAi.e. you haven't paid for it)===.* Even if the individuals could read your MX records, your local network is using IP addresses on a '''private subnet''', which is not routeable on the Internet, so it cannot be reached from outside of your system.

'''Perform === Verify the following Steps:'''Postfix Service Status ===

#Issue the following command to install the '''mailx''' application (MUA)Perform the following steps:<br><br>'''yum install mailx'''<br><br>#Refer to the link below to acquaint yourself on how to use the '''mailx''' application:<br> [http://www.binarytides.com/linux-mail-command-examples/ mail command examples and additional utilities]

===Testing mail #The '''postfix''' application should be installed by default. If it isn't, install it.#Postfix is capable of sending email with the internet===default configuration, so start and enable this service, and verify that the postfix service is running.#Look for the running postfix service in the list of listening ports by issuing the following command:<br><source>ss -atnp</source>#Which service is postfix running? Locate the port used by SMTP, and look for connections with the state LISTEN (i.e. currently listening).#Write your observations in your lab logbook.

We will now test === Testing the connection to see if your MTA for your VM2 machine is correctly running by sending email messages to other servers (both within and outside your virtual network).the Postfix Service ===

#Make certain you are in your If the '''vm2nc''' machine.#Test email from command is not installed on your vm2 machine by sending an email to your , install it (install '''Seneca email accountnc''' using the following command:<br><br>for your '''mail -s "PART C3" <Your Seneca email address>vm3'''<br><br>as well).# Connect from your '''NOTE:vm2''' after you type in your letter, enter a period in to itself using the first column on '''nc''' command by issuing the last line and hit the ENTER key.following command:<br><brsource >nc localhost 25</source>#Check your Seneca email account to You should see if you got the email (note that it may take a response: <br><usource >few minutes to arrive220 vm2.yourdomain.ops ESMTP Postfix</usource>, so you may also wish # You could theoretically use SMTP commands to try send an alternate email account if you have one like gmailhere, etc). When you do receive that email make but this would be a note very unusual use of the return address.#If you did not receive the mail, check the your mail logs on your vm2 machine to determine what the error isserver.#Test email from your Host Machine by sending You have an email to your Seneca account using the following command:<br><br>'''mail -s "PART C4" -r hacker@evil.com <Your Seneca email address>MUA'''<br><br>#Check your Seneca email to see if you got the email. If you did make for a note of the return addressreason.#Repeat Enter the steps for INSTALL &amp; command '''SETUP THE MAIL TRANSFER AGENT (MTA)QUIT''' and to close the connection to the server, then '''INSTALL &amp; SETUP THE MAIL USER AGENT (MUA)''' for your '''VM3<ctrl>-c''' and test by sending e-mail messages to your vm2 and Seneca e-mail accountterminate the nc command.

If you were able <ol><li value="4">Let's see if it works from other machines. Use '''nc''' to send e-mail connect to your Seneca e-mail account '''vm2''' from '''vm3''' and see if it works. If your VM2 and VM3firewall is set up properly, then we the nc command should test not permit a connection (i.e. ''no route to see if we can send email messages within our virtual private networkhost'').</li><li>Create an iptables rule to allow incoming connections to your '''SMTP''' server on your '''vm2'''.<br/li><li>FirstOnce you open the port in the firewall, letretry the '''nc''' command. You should get a different error this time (e.g. ''connection refused''). This time the problem is that your service isn't listening on the outside interface, it's send a message using a static IP ADDRESS for each VM:currently configured to listen only on the loopback (lo) interface.</li><li>Make sure the new iptables rule gets saved so that it will be loaded automatically from startup.</li></ol>

#Adjust your firewall We need to configure the MTA not only to listen to connections from other (iptablesseparate) MTAs, but to allow traffic to port 25 on both VMs.# Check your '''/var/log/maillog''' file to see set the log entries get created when mail is sent domain name and received, or notes when something goes wrong.#Try sending an email from '''vm2''' server name in order to your '''vm3''' by issuing allow the command:<br><br>'''mail -s "PART E2" yyyyyy@[192.168.X.4]'''<br><br>#Try sending an email from your '''vm3''' user to '''vm2''' by issuing issue emails in the command:<br><br>'''mail -s "PART E3standard way" root@[192.168.X, and allow mail messages to provide a correct email address for replies.3]''' <br><br>

Let# In your 's complete ''vm2''' machine, launch in editing session for the postfix configuration file called: '''/etc/postfix/main.cf'''# Our first editing change to the Postfix configuration will be to make the service "listen" for incoming connections on the external interface (i.e '''eth0''' from the VMs point of view).<br>Change the value of the following parameter to what is displayed below:<br><source>inet_interfaces = all</source># We should also set the string that will end up in the '''From:''' header in messages sent by this lab by sending email messages using our recently-created server.<br>Change the '''mydomain''' option to YOUR domain name(shown below):<source>mydomain = yoursenecaid.ops</source># Also you must set the '''hostname''' for this server so that will correctly specify the hostname in the '''From:''' header in a sent mail message.<br>Make certain the following parameter only appears once (shown below):<source>myorigin = $myhostname</source>#Ensure that your '''hostname''' and '''DOMAIN''' name is properly set on your machine, otherwise you will need to set the '''myhostname''' parameter.<br>{{Admon/important|Warning|Make sure there are no other un-commented copies of those above-mentioned parameters in the Postfix configuration file.}}<br><ol><li value="6">Restart the postfix service, then use the '''ss''' command to confirm that the your MTA is now listening on <u>all</u> interfaces (not just loopback)</li><li>Test by connecting to it (using the '''nc''' command) from your '''vm3''' machine.</li></ol>

'''Perform the following Steps:Record steps, commands, and your observations in INVESTIGATION 2 in your OPS335 lab log-book''' ==INVESTIGATION 3: SENDING EMAIL BETWEEN MTAs for vm2 and vm3 (NO ENCRYPTION)==

#Use the Your '''hostvm2''' and server should now be capable of '''hostname''' commands to confirm that each of your machines has the same 'sending'hostname'' and that the DNS service verifies this to be true.#Restart your MTA (postfix) server if you changed the hostname on either mail server.#Try sending mail to yourself on both machines. For example, as the username <senecaID> on VM 3, use the command:<br><br>$ mail <senecaID>@vm2.<yourdomain>.org<br><br>'''NOTE:receiving''' the machine will prompt for a subject: enter "testing" without the quotes.<br><br>#Enter the body of your e-mail message. When you have completed entering your email message, enter a period (.) in column 1 on the last line of your letter. This will send the signal: '''end-of-file''but we can' and your letter will t be mailedcertain until we test it. You should end up back at This also would not help the shell prompt. If you make a mistake, use '''CTRL-C''' to cancel the email (DO <u>NOT</u> USE CTRL-Z).#Use users on the '''mailq''' command on both other machines (you will need to be root) to view in the mail queue. Why would this command be useful for an administrator?#Use the mail command to check to see if you have received any mailnetwork, which are still not capable of receiving email.

'''Record Perform the following steps, commands, and your observations in INVESTIGATION 2 in your OPS335 lab log-book:'''

#What did changing Briefly list the steps to install the relay_domains parameter do?MUA on your server for text-based messaging.#What firewall rule or rules, Briefly list the steps to trouble-shoot your server if any, did you have could not send e-mail messages from your vm2 machine to an external e-mail server.#Write the command to send an e-mail message from your vm2 to enter so that email between your VMs would work?Seneca College e-mail account.#What is are the commands to issue in the mail prompt to:<ul><li>Read the first e-mail message displayed</li><li>Save the 4th e-mail message to the meaning of file pathname: ~/maildir/3.msg.txt</li><li>Delete the square brackets surrounding 3rd e-mail message displayed</li><li>Exit the IP address in mail command prompt and return to the examples?shell</li></ul>#What were the results of sending email between the VMsemails locally on your vm2 machine? Show log segments to verify your answers.# What is the purpose of an MTA?# What is the purpose of an MUA?# Draw a simple diagram showing how an MUA and an MTA are used to send e-mail messages between different servers.# List the steps to test a running postfix service using the nc application.